CVE-2026-17613: Security vulnerability

Published Aug 5, 2026

Updated

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

Event History

Aug 5, 2026

CVE Published

via MITRE·02:12 PM

Data Sourced

via MITRE·02:12 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-17613?

CVE-2026-17613 has a risk rating of 80, indicating it is critical.

What are the impacts of CVE-2026-17613?

CVE-2026-17613 allows authenticated users to overwrite files and subscribe to WebSocket events, facilitating data exfiltration and poisoning.

How do I fix CVE-2026-17613?

To mitigate CVE-2026-17613, ensure proper authorization checks are implemented for the import-binfile RPC command.

Who is affected by CVE-2026-17613?

Any instance of Penpot that allows authenticated users to access the import-binfile RPC command is vulnerable to CVE-2026-17613.

When was CVE-2026-17613 published?

CVE-2026-17613 was published on August 5, 2026.

CVE-2026-17613: Security vulnerability

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-17613?

What are the impacts of CVE-2026-17613?

How do I fix CVE-2026-17613?

Who is affected by CVE-2026-17613?

When was CVE-2026-17613 published?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-17613?

What are the impacts of CVE-2026-17613?

How do I fix CVE-2026-17613?

Who is affected by CVE-2026-17613?

When was CVE-2026-17613 published?